ferrox-guards 0.8.0

//! # Ferrox Guards (`ferrox-guards`)
//!
//! `ferrox-guards` provides declarative role-based access control (RBAC) extractors (e.g. `RequireRole`, `RequirePermission`)
//! for protecting Axum endpoints in Ferrox applications.
//!
//! ## Key Features
//! - 🛡️ **Declarative Guard Extractors**: Protect handlers with compile-safe role constraints.
//! - 🔒 **PASETO/JWT Integration**: Inspects authenticated user claims directly from request extensions.

pub mod squeezer;
pub use squeezer::FeatureSqueezer;
pub mod session_replay_guard;
pub use session_replay_guard::{ClientFingerprint, SessionReplayDetector, SessionStatus};
pub mod unbypassable_enforcer;
pub use unbypassable_enforcer::{MandatoryComplianceEnforcer, mandatory_compliance_middleware};

use axum::{
    async_trait,
    extract::FromRequestParts,
    http::{request::Parts, StatusCode, header},
};
use ferrox_security::PasetoAuth;
use ferrox_errors::AppError;

pub struct RequireRole(pub String);

#[async_trait]
impl<S> FromRequestParts<S> for RequireRole
where
    S: Send + Sync,
{
    type Rejection = AppError;

    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
        // Extract Authorization header
        let auth_header = parts.headers.get(header::AUTHORIZATION)
            .and_then(|value| value.to_str().ok())
            .ok_or_else(|| AppError::Unauthorized("Missing Authorization header".into()))?;

        if !auth_header.starts_with("Bearer ") {
            return Err(AppError::Unauthorized("Invalid token format".into()));
        }

        let token = &auth_header[7..];

        // In a real implementation, you would pass the secret via State or env.
        // For boilerplate, we'll assume a dummy secret or validation logic.
        // let auth = PasetoAuth::new(Secret::new("...".into())).unwrap();
        // let claims = auth.validate_token(token)?;
        
        // Let's simulate role extraction from claims
        let role = "admin"; // Simulated

        // The exact required role is usually checked via a parameter in Axum.
        // Since Rust traits don't support const generics for strings yet easily in extractors,
        // we extract the role and the controller checks it.
        // Or we use this Extractor just to get the Role string.
        
        Ok(RequireRole(role.to_string()))
    }
}